This policy explains what data the Zedlin apps, the Zedlin Sync service and this website (together, “Zedlin”) process, why, and what choices you have. Zedlin is built so that the contents of your workspaces are end-to-end encrypted and cannot be read by us.

Who we are

Zedlin is responsible for the data described here. You can reach us at support@zedlin.dev.

Your workspaces

Servers, keys, snippets, logins, one-time codes and other records in your workspaces are encrypted on your device before they are stored or synced. The keys are protected by your master password, which is never sent to us. We cannot read, sell or hand over the contents of your workspaces, because we cannot decrypt them.

Data we process for Zedlin Sync

Account: your email address and, if you sign in with Apple or Google, the account identifier they give us. If you use Sign in with Apple's private relay address, we only see that address.
Encrypted data: your encrypted workspace items and their size and change times. We cannot see what is inside them.
Devices: the devices signed in to your account, your approval devices' public keys and, if you allow notifications, a push token so we can tell a device that new data or an approval request is waiting.
Approval requests: requests from your computers to your approval devices pass through Zedlin Sync. Their contents are encrypted for the receiving device.
Security log: sign-ins, devices added or removed and account deletion, with the time and IP address, to protect your account and detect abuse.
Subscription: if you subscribe, Apple tells us the status of your subscription. Payments are handled by Apple; we never see your card details.

Team servers

A Zedlin team server is run by your organisation on its own infrastructure. The data on it — members, sessions, recordings, metrics, alerts and team passwords — is controlled by that organisation, not by us. Ask your organisation's administrator about how it is handled. When a team server sends an alert to your phone, the text is sealed for your device before it passes through our notification relay to Apple, so the relay cannot read it.

What we don't do

The apps contain no advertising and no third-party tracking or analytics. We don't sell or rent personal data. This website uses no advertising or tracking cookies.

Service providers

We use hosting and email providers to run Zedlin Sync and to send account emails, and push services from Apple and Google (Firebase) to deliver notifications. They process data only on our behalf.

Password health and site icons

To check whether a password has leaked, Zedlin sends the first five characters of the password's SHA-1 hash to the Have I Been Pwned service; the password itself is never sent, and you can turn this off. To show a site's icon, Zedlin may fetch it from that site, which sees an ordinary request from your device or team server.

How long we keep data

We keep your account and encrypted data while your account exists. When you delete your account in the app, your account and synced data are removed from Zedlin Sync, and if you signed in with Apple we revoke Zedlin's access to your Apple ID. Security log entries are kept only as long as needed to protect the service.

Your rights

Depending on where you live, including under the GDPR and Turkey's KVKK, you may have the right to access, correct, export or delete your personal data and to object to its processing. You can delete your account in the app at any time. For anything else, email support@zedlin.dev. You can also complain to your local data protection authority.

Children

Zedlin is not directed at children under 13, and we don't knowingly collect their data.

Changes

If we change this policy, we will update the date at the top and, for significant changes, tell you in the app or by email.

Privacy policy